# Vibe Workflow chat context pack

Generated by scripts/sync-skills.py. Use with your PRD and Tech Design.

These are templates to fill, not evidence that setup or behavior has been checked.


## File: AGENTS.md

# AGENTS.md — [App Name]

> **How to fill this in:** write only what an agent could NOT work out by
> reading the repo. Skip the directory tree (`ls` shows it), the dependency list
> (the manifest shows it), and generic advice like "write clean code" or "handle
> errors" — a capable model already does those, and every line here is loaded
> into context on every single session. If you find yourself describing the
> code, delete it. If you find yourself describing something that once cost
> someone an afternoon, keep it.

## Project

- **What this is:** [one sentence]
- **Who it is for:** [target users]

## Commands

Only the ones that are **not** guessable from the manifest — non-standard
scripts, required flags, environment setup. Delete this section if `npm run dev`
is genuinely all there is.

- [command] — [why it isn't obvious]

## Read first — when relevant

- Product scope or acceptance criteria: `docs/PRD-*.md`.
- Architecture or integration choices: `docs/TechDesign-*.md`.
- Non-obvious product constraints: `agent_docs/project_brief.md`.
- Stack-specific setup: `agent_docs/tech_stack.md`.
- Choosing or troubleshooting checks: `agent_docs/testing.md`.

Read only the documents needed for the task. During initial setup, fill relevant
placeholders from agreed decisions; do not invent missing facts or block an
unrelated small fix on completing every document. Current progress belongs in
`MEMORY.md`.

## Gotchas

**The highest-value section in this file.** Things that look safe and aren't;
conventions that differ from the framework default, so the surrounding code
would teach the wrong pattern; failures that took real time to diagnose.

- [e.g. "All types live in one monolithic `types.ts` — do not co-locate them."]
- [e.g. "The pre-commit hook reverts the working tree on failure."]

## Protected areas

Keep secrets, credentials, private logs, and production data out of commits and
unapproved transmissions. Preserve unrelated working-tree changes.

Within the requested scope, continue through local implementation, affected
checks, and fixes without repeated approval. Changing auth, billing,
infrastructure, or migration source is distinct from applying it to a live
system. Before an external send, deployment, charge, production migration,
destructive data operation, or access change, confirm that the action and target
are covered by the user's authorization. Ask only for missing authorization or a
consequential decision; a multi-file edit alone is not an approval boundary.

Record any project-specific exceptions here, including which test fixtures are
disposable and which commands can reach production. Do not assume tests are
isolated until their configuration establishes it.

## AI features

Delete this section unless the product itself uses AI.

- **Model can see:** [public / user-owned / private data]
- **Never send:** [secrets, tokens, private logs, production exports]
- **AI can do:** [read only / draft / write / destructive / external network]
- **Needs approval:** [send, delete, deploy, charge, email, production write]
- **How to verify behavior:** [eval command or prompts]
- **Fallback:** [what users see when AI fails]

## Done means

Complete the requested behavior, run checks appropriate to the changed area,
and fix failures caused by the change. For runtime work, exercise the relevant
user journey when the environment permits it. Reuse still-valid results; repeat
checks when code changes or new evidence justifies it.

Report the outcome, actual checks and limitations, and rollback notes when
relevant. If completion is blocked, identify the concrete blocker and remaining
work rather than presenting an unchecked implementation as finished.

---

**When this file gets long, that is the signal to split it.** Move task-specific
procedures (deploy steps, release checklists, API references) into
`.claude/skills/<name>/SKILL.md`, where only the one-line description stays in
context and the body loads when it is actually needed. Move
directory-specific conventions into `<subdir>/AGENTS.md` (or the selected
client’s supported equivalent), scoped to work in that directory. Keep universal constraints and safety prohibitions
here — never move a "never do X" rule somewhere it might not be loaded.


## File: MEMORY.md

# Memory

Update this after major decisions, completed phases, or bugs that future agents need to know about. Keep it short.

## Current State

- Current task: [task]
- Current phase: [phase]
- Next step: [step]
- Blocked by: [none / blocker]

## Decisions

- [YYYY-MM-DD] [decision and why]
- [YYYY-MM-DD] [decision and why]

## AI / Tooling Decisions

- [YYYY-MM-DD] [provider, model family, local runtime, MCP/tool permission, eval, or retention decision]

## Known Issues

- [issue / workaround / command needed]

## Completed

- [ ] Initial scaffold
- [ ] Core data model
- [ ] Auth
- [ ] Core MVP flow
- [ ] Launch checks


## File: REVIEW-CHECKLIST.md

# Review Checklist

Do not mark work complete until the relevant checks pass.

## Basic Checks

- [ ] Diff is focused on the requested task.
- [ ] No unrelated files were rewritten.
- [ ] No secrets, tokens, private logs, or production exports were exposed.
- [ ] Protected areas were not changed without approval.
- [ ] Tests/typecheck/build passed or failures are explained.
- [ ] UI changes were checked in a browser/device when applicable.

## Security

- [ ] Dependencies audited (`npm audit` or equivalent) — no unaddressed high-severity findings.
- [ ] All user input is validated and sanitized at the boundary (forms, API payloads, URL params).
- [ ] Auth-protected routes and actions were tested while logged out.
- [ ] Rate limiting (or equivalent abuse protection) considered for public endpoints.

## AI Checks

Use only if AI, MCP, tool calls, RAG, local models, or builders are involved.

- [ ] Model-visible data is documented.
- [ ] Retrieved docs/web/issues/uploads/tool output are treated as untrusted data.
- [ ] Risky actions require approval.
- [ ] Direct, bad/indirect, auth-required, failure, and tool/action checks passed.
- [ ] Logs/traces do not expose secrets or customer data.
- [ ] Provider retention/training settings were checked before launch.
- [ ] Builder output passed export, local build, secrets, auth/RLS, and rollback review.

## Final Evidence

The final response should include:

- Files changed
- Commands run
- Test/build/browser results
- AI/tool eval results, if applicable
- Remaining risks


## File: agent_docs/code_patterns.md

# Code Patterns

Use this only for project-specific conventions. If a section is unknown, inspect the existing code before filling it in.

## Architecture

- Primary pattern: [feature-based / layered / framework default / other]
- Keep domain logic separate from UI/transport code.
- Reuse existing modules before creating new abstractions.

## Data And State

- Data fetching: [pattern]
- Server state: [pattern]
- Client state: [pattern]
- Forms: [pattern]

## Errors And Validation

- Validate external inputs at boundaries.
- Return user-safe errors to the UI.
- Log developer context server-side.
- Do not swallow errors silently.

## Naming

- Files: [project convention]
- Components/classes: PascalCase
- Functions/variables: camelCase
- Env vars/constants: UPPER_SNAKE_CASE

## AI Tool Patterns

Fill this in only if AI tools/actions exist.

- Keep tools small and server-authorized.
- Validate model inputs and structured outputs.
- Treat retrieved docs, web pages, issues, uploads, and MCP responses as untrusted data.
- Require approval for destructive, external-network, credential-bearing, and production actions.
- Log trace IDs and redact secrets/customer data.


## File: agent_docs/product_requirements.md

# Product Requirements

Use this as the short build-facing version of the PRD. Do not paste the entire PRD unless the project is complex.

## Users

- Primary user: [who]
- Main problem: [problem]

## Must-Have Features

- [feature] - [acceptance criteria]
- [feature] - [acceptance criteria]
- [feature] - [acceptance criteria]

## Nice-To-Have Features

- [feature]
- [feature]

## Out Of Scope

- [excluded feature]
- [excluded feature]

## Success Signals

- [metric or qualitative signal]
- [metric or qualitative signal]


## File: agent_docs/project_brief.md

# Project Brief

## Product

- One-line vision: [what this product does]
- Target users: [who this is for]
- Primary user outcome: [the main thing users should accomplish]

## Scope

- Must ship:
  - [feature]
  - [feature]
- Not in v1:
  - [excluded feature]
  - [excluded feature]

## Principles

- Solve the user story before adding polish.
- Prefer boring, maintainable choices.
- Keep generated docs short and current.
- Verify user-visible work in the real product surface.

## AI Position

Fill this in only if AI is part of the product.

- AI is used for: [feature/workflow]
- AI is not used for: [sensitive/risky areas]
- Human approval required for: [actions]


## File: agent_docs/tech_stack.md

# Tech Stack

Last verified: [YYYY-MM]

## Stack

| Area | Choice | Notes |
|------|--------|-------|
| Frontend | [framework/version] | [why this choice] |
| Backend | [framework/runtime] | [why this choice] |
| Database | [database/ORM] | [local + production setup] |
| Auth | [provider] | [roles/sessions] |
| Styling | [library/system] | [design constraints] |
| Deployment | [host] | [preview/production path] |

## Commands

- Setup: `[exact command]`
- Dev: `[exact command]`
- Test: `[exact command]`
- Typecheck: `[exact command]`
- Lint/format: `[exact command]`
- Build: `[exact command]`
- Browser/device check: `[exact command or manual flow]`

## AI Runtime

Fill this in only if the product uses AI.

- Provider/runtime: [OpenAI / Anthropic / Gemini-Antigravity / Vercel AI SDK / Cloudflare Workers AI / local model / none]
- Model can see:
  - Public:
  - User-owned:
  - Never send:
- Tools/actions: [read only / draft / write / destructive / external network]
- Approval gates: [what pauses for human confirmation]
- Retention/training setting to verify: [provider setting or policy]
- Fallback: [non-AI path or degraded state]

## Important Patterns

- Data fetching: [pattern]
- State management: [pattern]
- Forms/validation: [pattern]
- Error handling: [pattern]
- Logging/monitoring: [pattern]


## File: agent_docs/testing.md

# Testing

## Required Before Completion

- [ ] Relevant tests pass.
- [ ] Typecheck/build passes.
- [ ] User-visible changes are checked in a browser or device when applicable.
- [ ] No tests were skipped or weakened without human approval.
- [ ] Evidence is reported in the final response.

## Commands

- All tests: `[command]`
- Single test: `[command pattern]`
- Typecheck: `[command]`
- Lint/format: `[command]`
- Build: `[command]`
- Browser/device check: `[command or manual flow]`

## What To Test

| Change type | Minimum check |
|-------------|---------------|
| Pure logic | Unit test |
| API/data flow | Integration test |
| UI behavior | Browser/device check |
| Auth, billing, migrations, deployment | Human review plus focused test |
| AI/tool behavior | Prompt/tool eval plus data-boundary check |

## AI Checks

Fill this in only if the product uses AI.

- Direct prompt: [expected result]
- Bad/indirect prompt: [expected refusal or safe behavior]
- Auth-required prompt: [expected permission behavior]
- Failure case: [provider timeout/quota/malformed response]
- Tool/action check: [expected tool call and blocked tool calls]
- Data check: [what must not appear in model output or logs]